Privacy Policy - Selfstorage Richmonduponthames

This Privacy Policy explains how Selfstorage Richmonduponthames collects, uses, stores, shares, and protects personal data relating to customers, prospective customers, visitors, and other individuals whose information is processed in connection with our storage services. It applies to all Selfstorage Richmonduponthames customers in the area, including anyone using our services, enquiring about our services, or otherwise interacting with us in relation to storage, access, administration, billing, and account management.

We are committed to handling personal data in a lawful, fair, and transparent manner in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy should be read carefully so you understand how and why your information is used, what rights you have, and how long we keep it.

1. Personal Data We Collect

We may collect and process personal data directly from you, from your use of our services, and from third parties where appropriate and permitted by law. The categories of data we collect may include:

Identity details such as name, title, date of birth, and identification information.
Contact details such as address, email address, and telephone number.
Account and service information including storage unit details, booking information, access records, correspondence, and customer support notes.
Payment and billing information such as payment method, transaction history, invoices, and account status.
Security information such as CCTV images where used on site, access logs, key or access card records, and incident reports.
Technical information such as device information, browser data, and limited usage data where collected through digital systems.
Other information you choose to provide to us when communicating with us or using our facilities.

We only collect what is necessary for the operation of our services, the protection of our premises, the fulfilment of contracts, and compliance with legal obligations.

2. How We Use Your Data

We use personal data for the following purposes:

To provide storage services and manage your account.
To verify identity and prevent fraud, misuse, or unauthorised access.
To process payments, issue invoices, and manage arrears or refunds.
To communicate with you regarding bookings, contracts, service changes, and operational matters.
To monitor and protect the security of our premises, staff, customers, and stored property.
To deal with complaints, disputes, claims, or incidents.
To meet regulatory, legal, insurance, and accounting requirements.
To improve our services, systems, and operational efficiency.

We do not use your data for purposes that are incompatible with the reasons for which it was collected unless we have a lawful basis to do so and, where required, we have notified you.

3. Lawful Basis for Processing

We process personal data only where we have a valid lawful basis under the UK GDPR. Depending on the circumstances, we may rely on one or more of the following:

Contract

We process data where it is necessary to enter into or perform a contract with you. This includes setting up storage agreements, managing accounts, and providing access to the storage service.

Legal Obligation

We may process data where required to comply with a legal duty, such as tax, accounting, anti-fraud, health and safety, or regulatory obligations.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include site security, protection of property, maintaining business records, investigating misuse, and improving service operations.

Consent

In limited cases, we may rely on your consent, for example where it is specifically required for a particular type of communication or optional processing. Where consent is used, you have the right to withdraw it at any time.

If we process special category data or data relating to criminal convictions, we will only do so where permitted by law and only when a specific lawful condition applies.

4. Data Sharing and Processors

We may share personal data with trusted third parties where necessary for the purposes described in this policy. These third parties may act as processors or as independent controllers depending on the service provided.

Processors may include:

Payment service providers who process card or electronic payments.
IT, hosting, and software providers who support account administration, communications, and secure storage of records.
Security providers who support CCTV, alarms, access control, and site monitoring systems.
Professional advisers such as accountants, auditors, insurers, or legal advisers.
Delivery, maintenance, or operational contractors where access to data is necessary for service delivery.

We require our processors to handle personal data securely, only on our instructions, and in accordance with data protection law. Where data is shared with independent third parties, they are responsible for their own compliance and privacy practices.

We may also disclose personal data where necessary to comply with law, enforce agreements, protect rights, or respond to lawful requests from public authorities.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, security, and reporting requirements. Retention periods depend on the type of data and the reason for processing.

Contract and account records are typically retained for the duration of the customer relationship and for a reasonable period afterwards to deal with queries, disputes, or legal claims.
Payment and accounting records are retained in line with tax and financial record-keeping obligations.
Security records, including access logs and CCTV images, are retained only for as long as necessary for security monitoring, incident investigation, or legal purposes.
Correspondence and support records are kept for as long as needed to manage the matter and maintain business records.

When personal data is no longer needed, we will delete it or anonymise it securely. In some cases, we may need to retain data for longer where required by law or in connection with an ongoing dispute or investigation.

6. Security of Your Data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures may include access controls, secure systems, staff training, and restricted retention of records.

No method of transmission or storage is completely secure, but we work to maintain a level of security appropriate to the risks presented by the processing of your data.

7. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to certain conditions and exemptions.

Right of access - You can request confirmation of whether we process your data and obtain a copy of that data.
Right to rectification - You can ask us to correct inaccurate or incomplete personal data.
Right to erasure - In certain circumstances, you can ask us to delete your data.
Right to restriction - You can ask us to restrict how we use your data in certain situations.
Right to object - You can object to processing based on legitimate interests or direct marketing.
Right to data portability - In some cases, you can request a copy of data you provided to us in a structured, commonly used format.
Right to withdraw consent - Where we rely on consent, you can withdraw it at any time.

You also have the right to raise a concern with the relevant data protection authority if you believe your rights have been infringed. We encourage you to contact us first so we can try to resolve any issue promptly and fairly.

8. International Transfers

Where personal data is transferred outside the UK, we will ensure suitable safeguards are in place, such as an adequacy decision or appropriate contractual protections, to ensure your data remains protected in accordance with applicable law.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. Any updated version will apply from the date it is issued. We encourage you to review this policy periodically so you remain informed about how your data is handled.

10. Scope of This Policy

This Privacy Policy applies to all Selfstorage Richmonduponthames customers in the area and to others whose personal data is processed in connection with our services. By using our storage services or interacting with us in relation to those services, you acknowledge that your personal data may be processed as described in this policy and in accordance with applicable data protection law.

We are committed to protecting your privacy and to handling your personal data responsibly, transparently, and securely.